DNSVIZ is a bit unclear in this case. It doesn't warn that the initial delegation from .com to google.com is insecure, but it does warn that the delegation from

DNSVIZ is a bit unclear in this case. It doesn't warn that the initial delegation from .com to google.com is insecure, but it does warn that the delegation from google.com to l.google.com is. Google doesn't use DNSSEC, unfortunately, so this shouldn't be a problem. If your resolver breaks on this, I think that may be the result of a bug or misconfiguration, because there's no DNSSEC to validate here.